When exactly are devDependencies included into the angular build

Question

I have an angular project that I build in two different ways - for two different environments (DEV and PROD; both on a corporate server)

Online I found different definitions of when the devDependencies (from package.json) are included into the build.

def1: only during local development -> not during runtime

def2: only when non-prod build

If definition 1 is accurate, then my question is obsolete. However, if definition 2 is true, then my question would be:

Which of the two commands do qualify as a prod build?

ng build --base-href /appname/
ng build --prod --base-href /appname/

This question is resulting from the fact that some of my devDependencies have sub-dependencies that are rated as insecure (company internally). If the devDependencies are not shipped with any deployment (neither DEV nor PROD), there is no issue.

Answer 1

The packages listed in the devDependencies section of package.json help you develop the application on your local machine. You don't deploy them with the production application.

build your production configuration using

ng build --prod --base-href /appname/

OR

 ng build --configuration=production --base-href /appname/